(add-to-load-path (dirname (current-filename)))

(use-modules
 (gnu)
 (gnu system) ;; for suoders specification
 (guix modules)
 (secret nginx)
 )

(use-service-modules admin ;;certbot
                     networking ssh web
                     )
(use-package-modules admin bootloaders
                     certs package-management
                     ssh tls)

(define %user "joshua")
(define %ssh-key-path "id_rsa.pub")

;; (define (set-up-html-directory directories)
;;   (when (not (access? "/srv/http" (logior R_OK W_OK)))
;;     (mkdir "/srv/http")))

;; (define %nginx-deploy-hook
;;   (program-file
;;    "nginx-deploy-hook"
;;    #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
;;        (kill pid SIGHUP))))

(define %system
  (operating-system
    (host-name "locke-lamora")
    (timezone "America/Chicago")
    (locale "en_US.UTF-8")
    ;; This goofy code will generate the grub.cfg
    ;; without installing the grub bootloader on disk.
    (bootloader (bootloader-configuration
                 (bootloader
                  (bootloader
                   (inherit grub-bootloader)
                   (installer #~(const #t))))))
    (file-systems (cons (file-system
                          (mount-point "/")
                          (device "/dev/sda1")
                          (type "ext4"))
                        %base-file-systems))

    ;; let user joshua, run a command with root privileges via
    ;;sudo w/o entering a password 
    (sudoers-file
     (plain-file "sudoers"
                 (string-append (plain-file-content %sudoers-specification)
                                (format #f "~a ALL = NOPASSWD: ALL~%"
                                        %user))))
    
    (swap-devices (list "/dev/sdb"))
    
    (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                          %base-initrd-modules))

    (users (cons (user-account
                  (name "joshua")
                  (group "users")
                  ;; Adding the account to the "wheel" group
                  ;; makes it a sudoer.
                  (supplementary-groups '("wheel"))
                  (home-directory "/home/joshua"))
                 %base-user-accounts))

    (packages (cons* nss-certs            ;for HTTPS access
                     openssh-sans-x
                     %base-packages))
    
    (services
     (cons*
      (service dhcp-client-service-type)

      ;; (service certbot-service-type
      ;;          (certbot-configuration
      ;;           (email "jbranso@dismail.de")
      ;;           (webroot "/srv/www")
      ;;           (certificates
      ;;            (list
      ;;             (certificate-configuration
      ;;              (name "gnucode.me")
      ;;              (domains '("gnucode.me" "www.gnucode.me"))
      ;;              (deploy-hook %nginx-deploy-hook))
      ;;             (certificate-configuration
      ;;              (name "gnu-hurd.com")
      ;;              (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
      ;;              (deploy-hook %nginx-deploy-hook))
      ;;             ))))

      (service nginx-service-type
               (nginx-configuration
                (server-blocks
                 (list
                  (nginx-server-configuration
                   (server-name '("gnucode.me"))
                   (listen '("80" "443 ssl"))
                   (root "/srv/www/html/gnucode.me/site/")
                   ;; tell browsers my site supports HTTPS, and tell them that it will
                   ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                   (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                   (ssl-certificate "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                   (ssl-certificate-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                   (locations
                    (list
                     (nginx-location-configuration          ;certbot
                      (uri "/.well-known")
                      (body (list "root /srv/www;")))
                     (nginx-location-configuration
                      (uri "/form/")
                      (body '("proxy_pass http://127.0.0.1:8081;")))
                     %gnucode-location 
                     )))
                  (nginx-server-configuration
                   (server-name '("gnu-hurd.com"))
                   (listen '("80" "443 ssl"))
                   (root "/srv/www/html/gnu-hurd.com/")
                   (ssl-certificate "/etc/letsencrypt/live/gnu-hurd.com/fullchain.pem")
                   (ssl-certificate-key "/etc/letsencrypt/live/gnu-hurd.com/privkey.pem")
                   ;; tell browsers my site supports HTTPS, and tell them that it will
                   ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                   (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                   (locations
                    (list
                     (nginx-location-configuration          ;certbot
                      (uri "/.well-known")
                      (body (list "root /srv/www;"))))))
                  ))))
      
      (service openssh-service-type
               (openssh-configuration
                (openssh openssh-sans-x)
                (password-authentication? #f)
                (authorized-keys
                 `(("joshua" ,(local-file %ssh-key-path))
                   ("root" ,(local-file %ssh-key-path))))))
      ;;(service unattended-upgrade-service-type)
      %base-services))))

(list (machine
       (operating-system %system)
       (environment managed-host-environment-type)
       (configuration (machine-ssh-configuration
                       (host-name "locke-lamora")
                       ;;(host-key "ssh_host_ed25519_key.pub")
                       (system "x86_64-linux")
                       (user "joshua")
                       ;;(identity "/home/joshua/.ssh/id_rsa")
                       ;;(port 22)
                       ))))
